Vulnerability identifier: #VU37055

Vulnerability risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-10508

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
OfficeScan
Client/Desktop applications / Antivirus software/Personal firewalls

Vendor: Trend Micro

Description

The vulnerability allows a remote authenticated user to execute arbitrary code.

A vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a attacker to use a specially crafted URL to elevate account permissions on vulnerable installations. An attacker must already have at least guest privileges in order to exploit this vulnerability.

Mitigation
Install update from vendor's website.

Vulnerable software versions

OfficeScan: 11.0 - XG

---

External links
http://success.trendmicro.com/solution/1119961

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.